SSL and TLS communication requires handshakes between the client and server in order to negotiate the security and establish the secure protocol tunnel.

SSL/TLS vulnerabilities use weak or improper implementations of SSL and TLS protocol specifications to compromise the communication channels, gain access to private information, and gain unauthorized access to applications and services.

Some APls that are Most Vulnerable Include:

• APls that are exposed using products with C-based security libraries such as OpenSSL
• APIs that are enabled with SSLv3, or TLSv1.0/1.1
• APls that use insecure cipher suites to negotiate the TLS tunnels
• APls that use weak key sizes
• APls that do not enforce client authentication

If any of vulnerabilities mentioned exists in your architecture we invite you to watch our 3-minute video on how you can protect your APIs and prevent SSL Threats using an API Security Gateway.